@workos-inc/node 8.0.0-beta.1 → 8.0.0-beta.3

package/lib/common/crypto/node-crypto-provider.js

@@ -0,0 +1,109 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || function (mod) {
+    if (mod && mod.__esModule) return mod;
+    var result = {};
+    if (mod != null) for (var k in mod) if (k !== "default" && Object.prototype.hasOwnProperty.call(mod, k)) __createBinding(result, mod, k);
+    __setModuleDefault(result, mod);
+    return result;
+};
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.NodeCryptoProvider = void 0;
+const crypto = __importStar(require("crypto"));
+const crypto_provider_1 = require("./crypto-provider");
+/**
+ * `CryptoProvider which uses the Node `crypto` package for its computations.
+ */
+class NodeCryptoProvider extends crypto_provider_1.CryptoProvider {
+    /** @override */
+    computeHMACSignature(payload, secret) {
+        return crypto
+            .createHmac('sha256', secret)
+            .update(payload, 'utf8')
+            .digest('hex');
+    }
+    /** @override */
+    computeHMACSignatureAsync(payload, secret) {
+        return __awaiter(this, void 0, void 0, function* () {
+            const signature = this.computeHMACSignature(payload, secret);
+            return signature;
+        });
+    }
+    /** @override */
+    secureCompare(stringA, stringB) {
+        return __awaiter(this, void 0, void 0, function* () {
+            const bufferA = this.encoder.encode(stringA);
+            const bufferB = this.encoder.encode(stringB);
+            if (bufferA.length !== bufferB.length) {
+                return false;
+            }
+            // Generate a random key for HMAC
+            const key = crypto.randomBytes(32); // Generates a 256-bit key
+            const hmacA = crypto.createHmac('sha256', key).update(bufferA).digest();
+            const hmacB = crypto.createHmac('sha256', key).update(bufferB).digest();
+            // Perform a constant time comparison
+            return crypto.timingSafeEqual(hmacA, hmacB);
+        });
+    }
+    encrypt(plaintext, key, iv, aad) {
+        return __awaiter(this, void 0, void 0, function* () {
+            const actualIv = iv || crypto.randomBytes(32);
+            const cipher = crypto.createCipheriv('aes-256-gcm', key, actualIv);
+            if (aad) {
+                cipher.setAAD(Buffer.from(aad));
+            }
+            const ciphertext = Buffer.concat([
+                cipher.update(Buffer.from(plaintext)),
+                cipher.final(),
+            ]);
+            const tag = cipher.getAuthTag();
+            return {
+                ciphertext: new Uint8Array(ciphertext),
+                iv: new Uint8Array(actualIv),
+                tag: new Uint8Array(tag),
+            };
+        });
+    }
+    decrypt(ciphertext, key, iv, tag, aad) {
+        return __awaiter(this, void 0, void 0, function* () {
+            const decipher = crypto.createDecipheriv('aes-256-gcm', key, iv);
+            decipher.setAuthTag(Buffer.from(tag));
+            if (aad) {
+                decipher.setAAD(Buffer.from(aad));
+            }
+            const decrypted = Buffer.concat([
+                decipher.update(Buffer.from(ciphertext)),
+                decipher.final(),
+            ]);
+            return new Uint8Array(decrypted);
+        });
+    }
+    randomBytes(length) {
+        return new Uint8Array(crypto.randomBytes(length));
+    }
+}
+exports.NodeCryptoProvider = NodeCryptoProvider;

package/lib/common/crypto/signature-provider.cjs

@@ -27,6 +27,7 @@ class SignatureProvider {
   static {
     __name(this, "SignatureProvider");
   }
+  cryptoProvider;
   constructor(cryptoProvider) {
     this.cryptoProvider = cryptoProvider;
   }

package/lib/common/crypto/signature-provider.cjs.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../src/common/crypto/signature-provider.ts"],"sourcesContent":["import { SignatureVerificationException } from '../exceptions';\nimport { CryptoProvider } from './crypto-provider';\n\nexport class SignatureProvider {\n  private cryptoProvider: CryptoProvider;\n\n  constructor(cryptoProvider: CryptoProvider) {\n    this.cryptoProvider = cryptoProvider;\n  }\n\n  async verifyHeader({\n    payload,\n    sigHeader,\n    secret,\n    tolerance = 180000,\n  }: {\n    payload: any;\n    sigHeader: string;\n    secret: string;\n    tolerance?: number;\n  }): Promise<boolean> {\n    const [timestamp, signatureHash] =\n      this.getTimestampAndSignatureHash(sigHeader);\n\n    if (!signatureHash || Object.keys(signatureHash).length === 0) {\n      throw new SignatureVerificationException(\n        'No signature hash found with expected scheme v1',\n      );\n    }\n\n    if (parseInt(timestamp, 10) < Date.now() - tolerance) {\n      throw new SignatureVerificationException(\n        'Timestamp outside the tolerance zone',\n      );\n    }\n\n    const expectedSig = await this.computeSignature(timestamp, payload, secret);\n    if (\n      (await this.cryptoProvider.secureCompare(expectedSig, signatureHash)) ===\n      false\n    ) {\n      throw new SignatureVerificationException(\n        'Signature hash does not match the expected signature hash for payload',\n      );\n    }\n    return true;\n  }\n\n  getTimestampAndSignatureHash(sigHeader: string): [string, string] {\n    const signature = sigHeader;\n    const [t, v1] = signature.split(',');\n    if (typeof t === 'undefined' || typeof v1 === 'undefined') {\n      throw new SignatureVerificationException(\n        'Signature or timestamp missing',\n      );\n    }\n    const { 1: timestamp } = t.split('=');\n    const { 1: signatureHash } = v1.split('=');\n\n    return [timestamp, signatureHash];\n  }\n\n  async computeSignature(\n    timestamp: any,\n    payload: any,\n    secret: string,\n  ): Promise<string> {\n    payload = JSON.stringify(payload);\n    const signedPayload = `${timestamp}.${payload}`;\n\n    return await this.cryptoProvider.computeHMACSignatureAsync(\n      signedPayload,\n      secret,\n    );\n  }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,wBAA+C;AAGxC,MAAM,kBAAkB;AAAA,EAH/B,OAG+B;AAAA;AAAA;AAAA,EAG7B,YAAY,gBAAgC;AAC1C,SAAK,iBAAiB;AAAA,EACxB;AAAA,EAEA,MAAM,aAAa;AAAA,IACjB;AAAA,IACA;AAAA,IACA;AAAA,IACA,YAAY;AAAA,EACd,GAKqB;AACnB,UAAM,CAAC,WAAW,aAAa,IAC7B,KAAK,6BAA6B,SAAS;AAE7C,QAAI,CAAC,iBAAiB,OAAO,KAAK,aAAa,EAAE,WAAW,GAAG;AAC7D,YAAM,IAAI;AAAA,QACR;AAAA,MACF;AAAA,IACF;AAEA,QAAI,SAAS,WAAW,EAAE,IAAI,KAAK,IAAI,IAAI,WAAW;AACpD,YAAM,IAAI;AAAA,QACR;AAAA,MACF;AAAA,IACF;AAEA,UAAM,cAAc,MAAM,KAAK,iBAAiB,WAAW,SAAS,MAAM;AAC1E,QACG,MAAM,KAAK,eAAe,cAAc,aAAa,aAAa,MACnE,OACA;AACA,YAAM,IAAI;AAAA,QACR;AAAA,MACF;AAAA,IACF;AACA,WAAO;AAAA,EACT;AAAA,EAEA,6BAA6B,WAAqC;AAChE,UAAM,YAAY;AAClB,UAAM,CAAC,GAAG,EAAE,IAAI,UAAU,MAAM,GAAG;AACnC,QAAI,OAAO,MAAM,eAAe,OAAO,OAAO,aAAa;AACzD,YAAM,IAAI;AAAA,QACR;AAAA,MACF;AAAA,IACF;AACA,UAAM,EAAE,GAAG,UAAU,IAAI,EAAE,MAAM,GAAG;AACpC,UAAM,EAAE,GAAG,cAAc,IAAI,GAAG,MAAM,GAAG;AAEzC,WAAO,CAAC,WAAW,aAAa;AAAA,EAClC;AAAA,EAEA,MAAM,iBACJ,WACA,SACA,QACiB;AACjB,cAAU,KAAK,UAAU,OAAO;AAChC,UAAM,gBAAgB,GAAG,SAAS,IAAI,OAAO;AAE7C,WAAO,MAAM,KAAK,eAAe;AAAA,MAC/B;AAAA,MACA;AAAA,IACF;AAAA,EACF;AACF;","names":[]}
+{"version":3,"sources":["../../../src/common/crypto/signature-provider.ts"],"sourcesContent":["import { SignatureVerificationException } from '../exceptions';\nimport { CryptoProvider } from './crypto-provider';\n\nexport class SignatureProvider {\n  private cryptoProvider: CryptoProvider;\n\n  constructor(cryptoProvider: CryptoProvider) {\n    this.cryptoProvider = cryptoProvider;\n  }\n\n  async verifyHeader({\n    payload,\n    sigHeader,\n    secret,\n    tolerance = 180000,\n  }: {\n    payload: any;\n    sigHeader: string;\n    secret: string;\n    tolerance?: number;\n  }): Promise<boolean> {\n    const [timestamp, signatureHash] =\n      this.getTimestampAndSignatureHash(sigHeader);\n\n    if (!signatureHash || Object.keys(signatureHash).length === 0) {\n      throw new SignatureVerificationException(\n        'No signature hash found with expected scheme v1',\n      );\n    }\n\n    if (parseInt(timestamp, 10) < Date.now() - tolerance) {\n      throw new SignatureVerificationException(\n        'Timestamp outside the tolerance zone',\n      );\n    }\n\n    const expectedSig = await this.computeSignature(timestamp, payload, secret);\n    if (\n      (await this.cryptoProvider.secureCompare(expectedSig, signatureHash)) ===\n      false\n    ) {\n      throw new SignatureVerificationException(\n        'Signature hash does not match the expected signature hash for payload',\n      );\n    }\n    return true;\n  }\n\n  getTimestampAndSignatureHash(sigHeader: string): [string, string] {\n    const signature = sigHeader;\n    const [t, v1] = signature.split(',');\n    if (typeof t === 'undefined' || typeof v1 === 'undefined') {\n      throw new SignatureVerificationException(\n        'Signature or timestamp missing',\n      );\n    }\n    const { 1: timestamp } = t.split('=');\n    const { 1: signatureHash } = v1.split('=');\n\n    return [timestamp, signatureHash];\n  }\n\n  async computeSignature(\n    timestamp: any,\n    payload: any,\n    secret: string,\n  ): Promise<string> {\n    payload = JSON.stringify(payload);\n    const signedPayload = `${timestamp}.${payload}`;\n\n    return await this.cryptoProvider.computeHMACSignatureAsync(\n      signedPayload,\n      secret,\n    );\n  }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,wBAA+C;AAGxC,MAAM,kBAAkB;AAAA,EAH/B,OAG+B;AAAA;AAAA;AAAA,EACrB;AAAA,EAER,YAAY,gBAAgC;AAC1C,SAAK,iBAAiB;AAAA,EACxB;AAAA,EAEA,MAAM,aAAa;AAAA,IACjB;AAAA,IACA;AAAA,IACA;AAAA,IACA,YAAY;AAAA,EACd,GAKqB;AACnB,UAAM,CAAC,WAAW,aAAa,IAC7B,KAAK,6BAA6B,SAAS;AAE7C,QAAI,CAAC,iBAAiB,OAAO,KAAK,aAAa,EAAE,WAAW,GAAG;AAC7D,YAAM,IAAI;AAAA,QACR;AAAA,MACF;AAAA,IACF;AAEA,QAAI,SAAS,WAAW,EAAE,IAAI,KAAK,IAAI,IAAI,WAAW;AACpD,YAAM,IAAI;AAAA,QACR;AAAA,MACF;AAAA,IACF;AAEA,UAAM,cAAc,MAAM,KAAK,iBAAiB,WAAW,SAAS,MAAM;AAC1E,QACG,MAAM,KAAK,eAAe,cAAc,aAAa,aAAa,MACnE,OACA;AACA,YAAM,IAAI;AAAA,QACR;AAAA,MACF;AAAA,IACF;AACA,WAAO;AAAA,EACT;AAAA,EAEA,6BAA6B,WAAqC;AAChE,UAAM,YAAY;AAClB,UAAM,CAAC,GAAG,EAAE,IAAI,UAAU,MAAM,GAAG;AACnC,QAAI,OAAO,MAAM,eAAe,OAAO,OAAO,aAAa;AACzD,YAAM,IAAI;AAAA,QACR;AAAA,MACF;AAAA,IACF;AACA,UAAM,EAAE,GAAG,UAAU,IAAI,EAAE,MAAM,GAAG;AACpC,UAAM,EAAE,GAAG,cAAc,IAAI,GAAG,MAAM,GAAG;AAEzC,WAAO,CAAC,WAAW,aAAa;AAAA,EAClC;AAAA,EAEA,MAAM,iBACJ,WACA,SACA,QACiB;AACjB,cAAU,KAAK,UAAU,OAAO;AAChC,UAAM,gBAAgB,GAAG,SAAS,IAAI,OAAO;AAE7C,WAAO,MAAM,KAAK,eAAe;AAAA,MAC/B;AAAA,MACA;AAAA,IACF;AAAA,EACF;AACF;","names":[]}

package/lib/common/crypto/signature-provider.d.ts

@@ -1,6 +1,5 @@
-import { CryptoProvider } from './crypto-provider.js';
-
-declare class SignatureProvider {
+import { CryptoProvider } from './crypto-provider';
+export declare class SignatureProvider {
     private cryptoProvider;
     constructor(cryptoProvider: CryptoProvider);
     verifyHeader({ payload, sigHeader, secret, tolerance, }: {
@@ -12,5 +11,3 @@ declare class SignatureProvider {
     getTimestampAndSignatureHash(sigHeader: string): [string, string];
     computeSignature(timestamp: any, payload: any, secret: string): Promise<string>;
 }
-
-export { SignatureProvider };

package/lib/common/crypto/signature-provider.js

@@ -1,60 +1,53 @@
-var __defProp = Object.defineProperty;
-var __name = (target, value) => __defProp(target, "name", { value, configurable: true });
-import { SignatureVerificationException } from "../exceptions";
+"use strict";
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.SignatureProvider = void 0;
+const exceptions_1 = require("../exceptions");
 class SignatureProvider {
-  static {
-    __name(this, "SignatureProvider");
-  }
-  constructor(cryptoProvider) {
-    this.cryptoProvider = cryptoProvider;
-  }
-  async verifyHeader({
-    payload,
-    sigHeader,
-    secret,
-    tolerance = 18e4
-  }) {
-    const [timestamp, signatureHash] = this.getTimestampAndSignatureHash(sigHeader);
-    if (!signatureHash || Object.keys(signatureHash).length === 0) {
-      throw new SignatureVerificationException(
-        "No signature hash found with expected scheme v1"
-      );
+    constructor(cryptoProvider) {
+        this.cryptoProvider = cryptoProvider;
     }
-    if (parseInt(timestamp, 10) < Date.now() - tolerance) {
-      throw new SignatureVerificationException(
-        "Timestamp outside the tolerance zone"
-      );
+    verifyHeader({ payload, sigHeader, secret, tolerance = 180000, }) {
+        return __awaiter(this, void 0, void 0, function* () {
+            const [timestamp, signatureHash] = this.getTimestampAndSignatureHash(sigHeader);
+            if (!signatureHash || Object.keys(signatureHash).length === 0) {
+                throw new exceptions_1.SignatureVerificationException('No signature hash found with expected scheme v1');
+            }
+            if (parseInt(timestamp, 10) < Date.now() - tolerance) {
+                throw new exceptions_1.SignatureVerificationException('Timestamp outside the tolerance zone');
+            }
+            const expectedSig = yield this.computeSignature(timestamp, payload, secret);
+            if ((yield this.cryptoProvider.secureCompare(expectedSig, signatureHash)) ===
+                false) {
+                throw new exceptions_1.SignatureVerificationException('Signature hash does not match the expected signature hash for payload');
+            }
+            return true;
+        });
     }
-    const expectedSig = await this.computeSignature(timestamp, payload, secret);
-    if (await this.cryptoProvider.secureCompare(expectedSig, signatureHash) === false) {
-      throw new SignatureVerificationException(
-        "Signature hash does not match the expected signature hash for payload"
-      );
+    getTimestampAndSignatureHash(sigHeader) {
+        const signature = sigHeader;
+        const [t, v1] = signature.split(',');
+        if (typeof t === 'undefined' || typeof v1 === 'undefined') {
+            throw new exceptions_1.SignatureVerificationException('Signature or timestamp missing');
+        }
+        const { 1: timestamp } = t.split('=');
+        const { 1: signatureHash } = v1.split('=');
+        return [timestamp, signatureHash];
     }
-    return true;
-  }
-  getTimestampAndSignatureHash(sigHeader) {
-    const signature = sigHeader;
-    const [t, v1] = signature.split(",");
-    if (typeof t === "undefined" || typeof v1 === "undefined") {
-      throw new SignatureVerificationException(
-        "Signature or timestamp missing"
-      );
+    computeSignature(timestamp, payload, secret) {
+        return __awaiter(this, void 0, void 0, function* () {
+            payload = JSON.stringify(payload);
+            const signedPayload = `${timestamp}.${payload}`;
+            return yield this.cryptoProvider.computeHMACSignatureAsync(signedPayload, secret);
+        });
     }
-    const { 1: timestamp } = t.split("=");
-    const { 1: signatureHash } = v1.split("=");
-    return [timestamp, signatureHash];
-  }
-  async computeSignature(timestamp, payload, secret) {
-    payload = JSON.stringify(payload);
-    const signedPayload = `${timestamp}.${payload}`;
-    return await this.cryptoProvider.computeHMACSignatureAsync(
-      signedPayload,
-      secret
-    );
-  }
 }
-export {
-  SignatureProvider
-};
-//# sourceMappingURL=signature-provider.js.map
+exports.SignatureProvider = SignatureProvider;

package/lib/common/crypto/signature-provider.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../src/common/crypto/signature-provider.ts"],"sourcesContent":["import { SignatureVerificationException } from '../exceptions';\nimport { CryptoProvider } from './crypto-provider';\n\nexport class SignatureProvider {\n  private cryptoProvider: CryptoProvider;\n\n  constructor(cryptoProvider: CryptoProvider) {\n    this.cryptoProvider = cryptoProvider;\n  }\n\n  async verifyHeader({\n    payload,\n    sigHeader,\n    secret,\n    tolerance = 180000,\n  }: {\n    payload: any;\n    sigHeader: string;\n    secret: string;\n    tolerance?: number;\n  }): Promise<boolean> {\n    const [timestamp, signatureHash] =\n      this.getTimestampAndSignatureHash(sigHeader);\n\n    if (!signatureHash || Object.keys(signatureHash).length === 0) {\n      throw new SignatureVerificationException(\n        'No signature hash found with expected scheme v1',\n      );\n    }\n\n    if (parseInt(timestamp, 10) < Date.now() - tolerance) {\n      throw new SignatureVerificationException(\n        'Timestamp outside the tolerance zone',\n      );\n    }\n\n    const expectedSig = await this.computeSignature(timestamp, payload, secret);\n    if (\n      (await this.cryptoProvider.secureCompare(expectedSig, signatureHash)) ===\n      false\n    ) {\n      throw new SignatureVerificationException(\n        'Signature hash does not match the expected signature hash for payload',\n      );\n    }\n    return true;\n  }\n\n  getTimestampAndSignatureHash(sigHeader: string): [string, string] {\n    const signature = sigHeader;\n    const [t, v1] = signature.split(',');\n    if (typeof t === 'undefined' || typeof v1 === 'undefined') {\n      throw new SignatureVerificationException(\n        'Signature or timestamp missing',\n      );\n    }\n    const { 1: timestamp } = t.split('=');\n    const { 1: signatureHash } = v1.split('=');\n\n    return [timestamp, signatureHash];\n  }\n\n  async computeSignature(\n    timestamp: any,\n    payload: any,\n    secret: string,\n  ): Promise<string> {\n    payload = JSON.stringify(payload);\n    const signedPayload = `${timestamp}.${payload}`;\n\n    return await this.cryptoProvider.computeHMACSignatureAsync(\n      signedPayload,\n      secret,\n    );\n  }\n}\n"],"mappings":";;AAAA,SAAS,sCAAsC;AAGxC,MAAM,kBAAkB;AAAA,EAH/B,OAG+B;AAAA;AAAA;AAAA,EAG7B,YAAY,gBAAgC;AAC1C,SAAK,iBAAiB;AAAA,EACxB;AAAA,EAEA,MAAM,aAAa;AAAA,IACjB;AAAA,IACA;AAAA,IACA;AAAA,IACA,YAAY;AAAA,EACd,GAKqB;AACnB,UAAM,CAAC,WAAW,aAAa,IAC7B,KAAK,6BAA6B,SAAS;AAE7C,QAAI,CAAC,iBAAiB,OAAO,KAAK,aAAa,EAAE,WAAW,GAAG;AAC7D,YAAM,IAAI;AAAA,QACR;AAAA,MACF;AAAA,IACF;AAEA,QAAI,SAAS,WAAW,EAAE,IAAI,KAAK,IAAI,IAAI,WAAW;AACpD,YAAM,IAAI;AAAA,QACR;AAAA,MACF;AAAA,IACF;AAEA,UAAM,cAAc,MAAM,KAAK,iBAAiB,WAAW,SAAS,MAAM;AAC1E,QACG,MAAM,KAAK,eAAe,cAAc,aAAa,aAAa,MACnE,OACA;AACA,YAAM,IAAI;AAAA,QACR;AAAA,MACF;AAAA,IACF;AACA,WAAO;AAAA,EACT;AAAA,EAEA,6BAA6B,WAAqC;AAChE,UAAM,YAAY;AAClB,UAAM,CAAC,GAAG,EAAE,IAAI,UAAU,MAAM,GAAG;AACnC,QAAI,OAAO,MAAM,eAAe,OAAO,OAAO,aAAa;AACzD,YAAM,IAAI;AAAA,QACR;AAAA,MACF;AAAA,IACF;AACA,UAAM,EAAE,GAAG,UAAU,IAAI,EAAE,MAAM,GAAG;AACpC,UAAM,EAAE,GAAG,cAAc,IAAI,GAAG,MAAM,GAAG;AAEzC,WAAO,CAAC,WAAW,aAAa;AAAA,EAClC;AAAA,EAEA,MAAM,iBACJ,WACA,SACA,QACiB;AACjB,cAAU,KAAK,UAAU,OAAO;AAChC,UAAM,gBAAgB,GAAG,SAAS,IAAI,OAAO;AAE7C,WAAO,MAAM,KAAK,eAAe;AAAA,MAC/B;AAAA,MACA;AAAA,IACF;AAAA,EACF;AACF;","names":[]}
+{"version":3,"sources":["../../../src/common/crypto/signature-provider.ts"],"sourcesContent":["import { SignatureVerificationException } from '../exceptions';\nimport { CryptoProvider } from './crypto-provider';\n\nexport class SignatureProvider {\n  private cryptoProvider: CryptoProvider;\n\n  constructor(cryptoProvider: CryptoProvider) {\n    this.cryptoProvider = cryptoProvider;\n  }\n\n  async verifyHeader({\n    payload,\n    sigHeader,\n    secret,\n    tolerance = 180000,\n  }: {\n    payload: any;\n    sigHeader: string;\n    secret: string;\n    tolerance?: number;\n  }): Promise<boolean> {\n    const [timestamp, signatureHash] =\n      this.getTimestampAndSignatureHash(sigHeader);\n\n    if (!signatureHash || Object.keys(signatureHash).length === 0) {\n      throw new SignatureVerificationException(\n        'No signature hash found with expected scheme v1',\n      );\n    }\n\n    if (parseInt(timestamp, 10) < Date.now() - tolerance) {\n      throw new SignatureVerificationException(\n        'Timestamp outside the tolerance zone',\n      );\n    }\n\n    const expectedSig = await this.computeSignature(timestamp, payload, secret);\n    if (\n      (await this.cryptoProvider.secureCompare(expectedSig, signatureHash)) ===\n      false\n    ) {\n      throw new SignatureVerificationException(\n        'Signature hash does not match the expected signature hash for payload',\n      );\n    }\n    return true;\n  }\n\n  getTimestampAndSignatureHash(sigHeader: string): [string, string] {\n    const signature = sigHeader;\n    const [t, v1] = signature.split(',');\n    if (typeof t === 'undefined' || typeof v1 === 'undefined') {\n      throw new SignatureVerificationException(\n        'Signature or timestamp missing',\n      );\n    }\n    const { 1: timestamp } = t.split('=');\n    const { 1: signatureHash } = v1.split('=');\n\n    return [timestamp, signatureHash];\n  }\n\n  async computeSignature(\n    timestamp: any,\n    payload: any,\n    secret: string,\n  ): Promise<string> {\n    payload = JSON.stringify(payload);\n    const signedPayload = `${timestamp}.${payload}`;\n\n    return await this.cryptoProvider.computeHMACSignatureAsync(\n      signedPayload,\n      secret,\n    );\n  }\n}\n"],"mappings":";;AAAA,SAAS,sCAAsC;AAGxC,MAAM,kBAAkB;AAAA,EAH/B,OAG+B;AAAA;AAAA;AAAA,EACrB;AAAA,EAER,YAAY,gBAAgC;AAC1C,SAAK,iBAAiB;AAAA,EACxB;AAAA,EAEA,MAAM,aAAa;AAAA,IACjB;AAAA,IACA;AAAA,IACA;AAAA,IACA,YAAY;AAAA,EACd,GAKqB;AACnB,UAAM,CAAC,WAAW,aAAa,IAC7B,KAAK,6BAA6B,SAAS;AAE7C,QAAI,CAAC,iBAAiB,OAAO,KAAK,aAAa,EAAE,WAAW,GAAG;AAC7D,YAAM,IAAI;AAAA,QACR;AAAA,MACF;AAAA,IACF;AAEA,QAAI,SAAS,WAAW,EAAE,IAAI,KAAK,IAAI,IAAI,WAAW;AACpD,YAAM,IAAI;AAAA,QACR;AAAA,MACF;AAAA,IACF;AAEA,UAAM,cAAc,MAAM,KAAK,iBAAiB,WAAW,SAAS,MAAM;AAC1E,QACG,MAAM,KAAK,eAAe,cAAc,aAAa,aAAa,MACnE,OACA;AACA,YAAM,IAAI;AAAA,QACR;AAAA,MACF;AAAA,IACF;AACA,WAAO;AAAA,EACT;AAAA,EAEA,6BAA6B,WAAqC;AAChE,UAAM,YAAY;AAClB,UAAM,CAAC,GAAG,EAAE,IAAI,UAAU,MAAM,GAAG;AACnC,QAAI,OAAO,MAAM,eAAe,OAAO,OAAO,aAAa;AACzD,YAAM,IAAI;AAAA,QACR;AAAA,MACF;AAAA,IACF;AACA,UAAM,EAAE,GAAG,UAAU,IAAI,EAAE,MAAM,GAAG;AACpC,UAAM,EAAE,GAAG,cAAc,IAAI,GAAG,MAAM,GAAG;AAEzC,WAAO,CAAC,WAAW,aAAa;AAAA,EAClC;AAAA,EAEA,MAAM,iBACJ,WACA,SACA,QACiB;AACjB,cAAU,KAAK,UAAU,OAAO;AAChC,UAAM,gBAAgB,GAAG,SAAS,IAAI,OAAO;AAE7C,WAAO,MAAM,KAAK,eAAe;AAAA,MAC/B;AAAA,MACA;AAAA,IACF;AAAA,EACF;AACF;","names":[]}

package/lib/common/crypto/signature-provider.spec.d.ts

@@ -0,0 +1 @@
+export {};

package/lib/common/crypto/signature-provider.spec.js

@@ -0,0 +1,66 @@
+"use strict";
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+const crypto_1 = __importDefault(require("crypto"));
+const subtle_crypto_provider_1 = require("./subtle-crypto-provider");
+const webhook_json_1 = __importDefault(require("../../webhooks/fixtures/webhook.json"));
+const signature_provider_1 = require("./signature-provider");
+describe('SignatureProvider', () => {
+    let payload;
+    let secret;
+    let timestamp;
+    let signatureHash;
+    const signatureProvider = new signature_provider_1.SignatureProvider(new subtle_crypto_provider_1.SubtleCryptoProvider());
+    beforeEach(() => {
+        payload = webhook_json_1.default;
+        secret = 'secret';
+        timestamp = Date.now() * 1000;
+        const unhashedString = `${timestamp}.${JSON.stringify(payload)}`;
+        signatureHash = crypto_1.default
+            .createHmac('sha256', secret)
+            .update(unhashedString)
+            .digest()
+            .toString('hex');
+    });
+    describe('verifyHeader', () => {
+        it('returns true when the signature is valid', () => __awaiter(void 0, void 0, void 0, function* () {
+            const sigHeader = `t=${timestamp}, v1=${signatureHash}`;
+            const options = { payload, sigHeader, secret };
+            const result = yield signatureProvider.verifyHeader(options);
+            expect(result).toBeTruthy();
+        }));
+    });
+    describe('getTimestampAndSignatureHash', () => {
+        it('returns the timestamp and signature when the signature is valid', () => {
+            const sigHeader = `t=${timestamp}, v1=${signatureHash}`;
+            const timestampAndSignature = signatureProvider.getTimestampAndSignatureHash(sigHeader);
+            expect(timestampAndSignature).toEqual([
+                timestamp.toString(),
+                signatureHash,
+            ]);
+        });
+    });
+    describe('computeSignature', () => {
+        it('returns the computed signature', () => __awaiter(void 0, void 0, void 0, function* () {
+            const signature = yield signatureProvider.computeSignature(timestamp, payload, secret);
+            expect(signature).toEqual(signatureHash);
+        }));
+    });
+    describe('when in an environment that supports SubtleCrypto', () => {
+        it('automatically uses the subtle crypto library', () => {
+            // tslint:disable-next-line
+            expect(signatureProvider['cryptoProvider']).toBeInstanceOf(subtle_crypto_provider_1.SubtleCryptoProvider);
+        });
+    });
+});

package/lib/common/crypto/subtle-crypto-provider.cjs

@@ -27,6 +27,7 @@ class SubtleCryptoProvider extends import_crypto_provider.CryptoProvider {
   static {
     __name(this, "SubtleCryptoProvider");
   }
+  subtleCrypto;
   constructor(subtleCrypto) {
     super();
     this.subtleCrypto = subtleCrypto || crypto.subtle;

package/lib/common/crypto/subtle-crypto-provider.cjs.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../src/common/crypto/subtle-crypto-provider.ts"],"sourcesContent":["import { CryptoProvider } from './crypto-provider';\n\n/**\n * `CryptoProvider which uses the SubtleCrypto interface of the Web Crypto API.\n *\n * This only supports asynchronous operations.\n */\nexport class SubtleCryptoProvider extends CryptoProvider {\n  subtleCrypto: SubtleCrypto;\n\n  constructor(subtleCrypto?: SubtleCrypto) {\n    super();\n\n    // If no subtle crypto is interface, default to the global namespace. This\n    // is to allow custom interfaces (eg. using the Node webcrypto interface in\n    // tests).\n    this.subtleCrypto = subtleCrypto || crypto.subtle;\n  }\n\n  computeHMACSignature(_payload: string, _secret: string): string {\n    throw new Error(\n      'SubleCryptoProvider cannot be used in a synchronous context.',\n    );\n  }\n\n  /** @override */\n  async computeHMACSignatureAsync(\n    payload: string,\n    secret: string,\n  ): Promise<string> {\n    const encoder = new TextEncoder();\n\n    const key = await this.subtleCrypto.importKey(\n      'raw',\n      encoder.encode(secret),\n      {\n        name: 'HMAC',\n        hash: { name: 'SHA-256' },\n      },\n      false,\n      ['sign'],\n    );\n\n    const signatureBuffer = await this.subtleCrypto.sign(\n      'hmac',\n      key,\n      encoder.encode(payload),\n    );\n\n    // crypto.subtle returns the signature in base64 format. This must be\n    // encoded in hex to match the CryptoProvider contract. We map each byte in\n    // the buffer to its corresponding hex octet and then combine into a string.\n    const signatureBytes = new Uint8Array(signatureBuffer);\n    const signatureHexCodes = new Array(signatureBytes.length);\n\n    for (let i = 0; i < signatureBytes.length; i++) {\n      signatureHexCodes[i] = byteHexMapping[signatureBytes[i]];\n    }\n\n    return signatureHexCodes.join('');\n  }\n\n  /** @override */\n  async secureCompare(stringA: string, stringB: string): Promise<boolean> {\n    const bufferA = this.encoder.encode(stringA);\n    const bufferB = this.encoder.encode(stringB);\n\n    if (bufferA.length !== bufferB.length) {\n      return false;\n    }\n\n    const algorithm = { name: 'HMAC', hash: 'SHA-256' };\n    const key = (await crypto.subtle.generateKey(algorithm, false, [\n      'sign',\n      'verify',\n    ])) as CryptoKey;\n    const hmac = await crypto.subtle.sign(algorithm, key, bufferA);\n    const equal = await crypto.subtle.verify(algorithm, key, hmac, bufferB);\n\n    return equal;\n  }\n\n  async encrypt(\n    plaintext: Uint8Array,\n    key: Uint8Array,\n    iv?: Uint8Array,\n    aad?: Uint8Array,\n  ): Promise<{\n    ciphertext: Uint8Array;\n    iv: Uint8Array;\n    tag: Uint8Array;\n  }> {\n    const actualIv = iv || crypto.getRandomValues(new Uint8Array(32));\n\n    const cryptoKey = await this.subtleCrypto.importKey(\n      'raw',\n      key,\n      { name: 'AES-GCM' },\n      false,\n      ['encrypt'],\n    );\n\n    const encryptParams: AesGcmParams = {\n      name: 'AES-GCM',\n      iv: actualIv,\n    };\n\n    if (aad) {\n      encryptParams.additionalData = aad;\n    }\n\n    const encryptedData = await this.subtleCrypto.encrypt(\n      encryptParams,\n      cryptoKey,\n      plaintext,\n    );\n\n    const encryptedBytes = new Uint8Array(encryptedData);\n\n    // Extract tag (last 16 bytes)\n    const tagSize = 16;\n    const tagStart = encryptedBytes.length - tagSize;\n    const tag = encryptedBytes.slice(tagStart);\n    const ciphertext = encryptedBytes.slice(0, tagStart);\n\n    return {\n      ciphertext,\n      iv: actualIv,\n      tag,\n    };\n  }\n\n  async decrypt(\n    ciphertext: Uint8Array,\n    key: Uint8Array,\n    iv: Uint8Array,\n    tag: Uint8Array,\n    aad?: Uint8Array,\n  ): Promise<Uint8Array> {\n    // SubtleCrypto expects tag to be appended to ciphertext for AES-GCM\n    const combinedData = new Uint8Array(ciphertext.length + tag.length);\n    combinedData.set(ciphertext, 0);\n    combinedData.set(tag, ciphertext.length);\n\n    const cryptoKey = await this.subtleCrypto.importKey(\n      'raw',\n      key,\n      { name: 'AES-GCM' },\n      false,\n      ['decrypt'],\n    );\n\n    const decryptParams: AesGcmParams = {\n      name: 'AES-GCM',\n      iv,\n    };\n\n    if (aad) {\n      decryptParams.additionalData = aad;\n    }\n\n    const decryptedData = await this.subtleCrypto.decrypt(\n      decryptParams,\n      cryptoKey,\n      combinedData,\n    );\n\n    return new Uint8Array(decryptedData);\n  }\n\n  randomBytes(length: number): Uint8Array {\n    const bytes = new Uint8Array(length);\n    crypto.getRandomValues(bytes);\n    return bytes;\n  }\n}\n\n// Cached mapping of byte to hex representation. We do this once to avoid re-\n// computing every time we need to convert the result of a signature to hex.\nconst byteHexMapping = new Array(256);\nfor (let i = 0; i < byteHexMapping.length; i++) {\n  byteHexMapping[i] = i.toString(16).padStart(2, '0');\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,6BAA+B;AAOxB,MAAM,6BAA6B,sCAAe;AAAA,EAPzD,OAOyD;AAAA;AAAA;AAAA,EAGvD,YAAY,cAA6B;AACvC,UAAM;AAKN,SAAK,eAAe,gBAAgB,OAAO;AAAA,EAC7C;AAAA,EAEA,qBAAqB,UAAkB,SAAyB;AAC9D,UAAM,IAAI;AAAA,MACR;AAAA,IACF;AAAA,EACF;AAAA;AAAA,EAGA,MAAM,0BACJ,SACA,QACiB;AACjB,UAAM,UAAU,IAAI,YAAY;AAEhC,UAAM,MAAM,MAAM,KAAK,aAAa;AAAA,MAClC;AAAA,MACA,QAAQ,OAAO,MAAM;AAAA,MACrB;AAAA,QACE,MAAM;AAAA,QACN,MAAM,EAAE,MAAM,UAAU;AAAA,MAC1B;AAAA,MACA;AAAA,MACA,CAAC,MAAM;AAAA,IACT;AAEA,UAAM,kBAAkB,MAAM,KAAK,aAAa;AAAA,MAC9C;AAAA,MACA;AAAA,MACA,QAAQ,OAAO,OAAO;AAAA,IACxB;AAKA,UAAM,iBAAiB,IAAI,WAAW,eAAe;AACrD,UAAM,oBAAoB,IAAI,MAAM,eAAe,MAAM;AAEzD,aAAS,IAAI,GAAG,IAAI,eAAe,QAAQ,KAAK;AAC9C,wBAAkB,CAAC,IAAI,eAAe,eAAe,CAAC,CAAC;AAAA,IACzD;AAEA,WAAO,kBAAkB,KAAK,EAAE;AAAA,EAClC;AAAA;AAAA,EAGA,MAAM,cAAc,SAAiB,SAAmC;AACtE,UAAM,UAAU,KAAK,QAAQ,OAAO,OAAO;AAC3C,UAAM,UAAU,KAAK,QAAQ,OAAO,OAAO;AAE3C,QAAI,QAAQ,WAAW,QAAQ,QAAQ;AACrC,aAAO;AAAA,IACT;AAEA,UAAM,YAAY,EAAE,MAAM,QAAQ,MAAM,UAAU;AAClD,UAAM,MAAO,MAAM,OAAO,OAAO,YAAY,WAAW,OAAO;AAAA,MAC7D;AAAA,MACA;AAAA,IACF,CAAC;AACD,UAAM,OAAO,MAAM,OAAO,OAAO,KAAK,WAAW,KAAK,OAAO;AAC7D,UAAM,QAAQ,MAAM,OAAO,OAAO,OAAO,WAAW,KAAK,MAAM,OAAO;AAEtE,WAAO;AAAA,EACT;AAAA,EAEA,MAAM,QACJ,WACA,KACA,IACA,KAKC;AACD,UAAM,WAAW,MAAM,OAAO,gBAAgB,IAAI,WAAW,EAAE,CAAC;AAEhE,UAAM,YAAY,MAAM,KAAK,aAAa;AAAA,MACxC;AAAA,MACA;AAAA,MACA,EAAE,MAAM,UAAU;AAAA,MAClB;AAAA,MACA,CAAC,SAAS;AAAA,IACZ;AAEA,UAAM,gBAA8B;AAAA,MAClC,MAAM;AAAA,MACN,IAAI;AAAA,IACN;AAEA,QAAI,KAAK;AACP,oBAAc,iBAAiB;AAAA,IACjC;AAEA,UAAM,gBAAgB,MAAM,KAAK,aAAa;AAAA,MAC5C;AAAA,MACA;AAAA,MACA;AAAA,IACF;AAEA,UAAM,iBAAiB,IAAI,WAAW,aAAa;AAGnD,UAAM,UAAU;AAChB,UAAM,WAAW,eAAe,SAAS;AACzC,UAAM,MAAM,eAAe,MAAM,QAAQ;AACzC,UAAM,aAAa,eAAe,MAAM,GAAG,QAAQ;AAEnD,WAAO;AAAA,MACL;AAAA,MACA,IAAI;AAAA,MACJ;AAAA,IACF;AAAA,EACF;AAAA,EAEA,MAAM,QACJ,YACA,KACA,IACA,KACA,KACqB;AAErB,UAAM,eAAe,IAAI,WAAW,WAAW,SAAS,IAAI,MAAM;AAClE,iBAAa,IAAI,YAAY,CAAC;AAC9B,iBAAa,IAAI,KAAK,WAAW,MAAM;AAEvC,UAAM,YAAY,MAAM,KAAK,aAAa;AAAA,MACxC;AAAA,MACA;AAAA,MACA,EAAE,MAAM,UAAU;AAAA,MAClB;AAAA,MACA,CAAC,SAAS;AAAA,IACZ;AAEA,UAAM,gBAA8B;AAAA,MAClC,MAAM;AAAA,MACN;AAAA,IACF;AAEA,QAAI,KAAK;AACP,oBAAc,iBAAiB;AAAA,IACjC;AAEA,UAAM,gBAAgB,MAAM,KAAK,aAAa;AAAA,MAC5C;AAAA,MACA;AAAA,MACA;AAAA,IACF;AAEA,WAAO,IAAI,WAAW,aAAa;AAAA,EACrC;AAAA,EAEA,YAAY,QAA4B;AACtC,UAAM,QAAQ,IAAI,WAAW,MAAM;AACnC,WAAO,gBAAgB,KAAK;AAC5B,WAAO;AAAA,EACT;AACF;AAIA,MAAM,iBAAiB,IAAI,MAAM,GAAG;AACpC,SAAS,IAAI,GAAG,IAAI,eAAe,QAAQ,KAAK;AAC9C,iBAAe,CAAC,IAAI,EAAE,SAAS,EAAE,EAAE,SAAS,GAAG,GAAG;AACpD;","names":[]}
+{"version":3,"sources":["../../../src/common/crypto/subtle-crypto-provider.ts"],"sourcesContent":["import { CryptoProvider } from './crypto-provider';\n\n/**\n * `CryptoProvider which uses the SubtleCrypto interface of the Web Crypto API.\n *\n * This only supports asynchronous operations.\n */\nexport class SubtleCryptoProvider extends CryptoProvider {\n  subtleCrypto: SubtleCrypto;\n\n  constructor(subtleCrypto?: SubtleCrypto) {\n    super();\n\n    // If no subtle crypto is interface, default to the global namespace. This\n    // is to allow custom interfaces (eg. using the Node webcrypto interface in\n    // tests).\n    this.subtleCrypto = subtleCrypto || crypto.subtle;\n  }\n\n  computeHMACSignature(_payload: string, _secret: string): string {\n    throw new Error(\n      'SubleCryptoProvider cannot be used in a synchronous context.',\n    );\n  }\n\n  /** @override */\n  async computeHMACSignatureAsync(\n    payload: string,\n    secret: string,\n  ): Promise<string> {\n    const encoder = new TextEncoder();\n\n    const key = await this.subtleCrypto.importKey(\n      'raw',\n      encoder.encode(secret),\n      {\n        name: 'HMAC',\n        hash: { name: 'SHA-256' },\n      },\n      false,\n      ['sign'],\n    );\n\n    const signatureBuffer = await this.subtleCrypto.sign(\n      'hmac',\n      key,\n      encoder.encode(payload),\n    );\n\n    // crypto.subtle returns the signature in base64 format. This must be\n    // encoded in hex to match the CryptoProvider contract. We map each byte in\n    // the buffer to its corresponding hex octet and then combine into a string.\n    const signatureBytes = new Uint8Array(signatureBuffer);\n    const signatureHexCodes = new Array(signatureBytes.length);\n\n    for (let i = 0; i < signatureBytes.length; i++) {\n      signatureHexCodes[i] = byteHexMapping[signatureBytes[i]];\n    }\n\n    return signatureHexCodes.join('');\n  }\n\n  /** @override */\n  async secureCompare(stringA: string, stringB: string): Promise<boolean> {\n    const bufferA = this.encoder.encode(stringA);\n    const bufferB = this.encoder.encode(stringB);\n\n    if (bufferA.length !== bufferB.length) {\n      return false;\n    }\n\n    const algorithm = { name: 'HMAC', hash: 'SHA-256' };\n    const key = (await crypto.subtle.generateKey(algorithm, false, [\n      'sign',\n      'verify',\n    ])) as CryptoKey;\n    const hmac = await crypto.subtle.sign(algorithm, key, bufferA);\n    const equal = await crypto.subtle.verify(algorithm, key, hmac, bufferB);\n\n    return equal;\n  }\n\n  async encrypt(\n    plaintext: Uint8Array,\n    key: Uint8Array,\n    iv?: Uint8Array,\n    aad?: Uint8Array,\n  ): Promise<{\n    ciphertext: Uint8Array;\n    iv: Uint8Array;\n    tag: Uint8Array;\n  }> {\n    const actualIv = iv || crypto.getRandomValues(new Uint8Array(32));\n\n    const cryptoKey = await this.subtleCrypto.importKey(\n      'raw',\n      key,\n      { name: 'AES-GCM' },\n      false,\n      ['encrypt'],\n    );\n\n    const encryptParams: AesGcmParams = {\n      name: 'AES-GCM',\n      iv: actualIv,\n    };\n\n    if (aad) {\n      encryptParams.additionalData = aad;\n    }\n\n    const encryptedData = await this.subtleCrypto.encrypt(\n      encryptParams,\n      cryptoKey,\n      plaintext,\n    );\n\n    const encryptedBytes = new Uint8Array(encryptedData);\n\n    // Extract tag (last 16 bytes)\n    const tagSize = 16;\n    const tagStart = encryptedBytes.length - tagSize;\n    const tag = encryptedBytes.slice(tagStart);\n    const ciphertext = encryptedBytes.slice(0, tagStart);\n\n    return {\n      ciphertext,\n      iv: actualIv,\n      tag,\n    };\n  }\n\n  async decrypt(\n    ciphertext: Uint8Array,\n    key: Uint8Array,\n    iv: Uint8Array,\n    tag: Uint8Array,\n    aad?: Uint8Array,\n  ): Promise<Uint8Array> {\n    // SubtleCrypto expects tag to be appended to ciphertext for AES-GCM\n    const combinedData = new Uint8Array(ciphertext.length + tag.length);\n    combinedData.set(ciphertext, 0);\n    combinedData.set(tag, ciphertext.length);\n\n    const cryptoKey = await this.subtleCrypto.importKey(\n      'raw',\n      key,\n      { name: 'AES-GCM' },\n      false,\n      ['decrypt'],\n    );\n\n    const decryptParams: AesGcmParams = {\n      name: 'AES-GCM',\n      iv,\n    };\n\n    if (aad) {\n      decryptParams.additionalData = aad;\n    }\n\n    const decryptedData = await this.subtleCrypto.decrypt(\n      decryptParams,\n      cryptoKey,\n      combinedData,\n    );\n\n    return new Uint8Array(decryptedData);\n  }\n\n  randomBytes(length: number): Uint8Array {\n    const bytes = new Uint8Array(length);\n    crypto.getRandomValues(bytes);\n    return bytes;\n  }\n}\n\n// Cached mapping of byte to hex representation. We do this once to avoid re-\n// computing every time we need to convert the result of a signature to hex.\nconst byteHexMapping = new Array(256);\nfor (let i = 0; i < byteHexMapping.length; i++) {\n  byteHexMapping[i] = i.toString(16).padStart(2, '0');\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,6BAA+B;AAOxB,MAAM,6BAA6B,sCAAe;AAAA,EAPzD,OAOyD;AAAA;AAAA;AAAA,EACvD;AAAA,EAEA,YAAY,cAA6B;AACvC,UAAM;AAKN,SAAK,eAAe,gBAAgB,OAAO;AAAA,EAC7C;AAAA,EAEA,qBAAqB,UAAkB,SAAyB;AAC9D,UAAM,IAAI;AAAA,MACR;AAAA,IACF;AAAA,EACF;AAAA;AAAA,EAGA,MAAM,0BACJ,SACA,QACiB;AACjB,UAAM,UAAU,IAAI,YAAY;AAEhC,UAAM,MAAM,MAAM,KAAK,aAAa;AAAA,MAClC;AAAA,MACA,QAAQ,OAAO,MAAM;AAAA,MACrB;AAAA,QACE,MAAM;AAAA,QACN,MAAM,EAAE,MAAM,UAAU;AAAA,MAC1B;AAAA,MACA;AAAA,MACA,CAAC,MAAM;AAAA,IACT;AAEA,UAAM,kBAAkB,MAAM,KAAK,aAAa;AAAA,MAC9C;AAAA,MACA;AAAA,MACA,QAAQ,OAAO,OAAO;AAAA,IACxB;AAKA,UAAM,iBAAiB,IAAI,WAAW,eAAe;AACrD,UAAM,oBAAoB,IAAI,MAAM,eAAe,MAAM;AAEzD,aAAS,IAAI,GAAG,IAAI,eAAe,QAAQ,KAAK;AAC9C,wBAAkB,CAAC,IAAI,eAAe,eAAe,CAAC,CAAC;AAAA,IACzD;AAEA,WAAO,kBAAkB,KAAK,EAAE;AAAA,EAClC;AAAA;AAAA,EAGA,MAAM,cAAc,SAAiB,SAAmC;AACtE,UAAM,UAAU,KAAK,QAAQ,OAAO,OAAO;AAC3C,UAAM,UAAU,KAAK,QAAQ,OAAO,OAAO;AAE3C,QAAI,QAAQ,WAAW,QAAQ,QAAQ;AACrC,aAAO;AAAA,IACT;AAEA,UAAM,YAAY,EAAE,MAAM,QAAQ,MAAM,UAAU;AAClD,UAAM,MAAO,MAAM,OAAO,OAAO,YAAY,WAAW,OAAO;AAAA,MAC7D;AAAA,MACA;AAAA,IACF,CAAC;AACD,UAAM,OAAO,MAAM,OAAO,OAAO,KAAK,WAAW,KAAK,OAAO;AAC7D,UAAM,QAAQ,MAAM,OAAO,OAAO,OAAO,WAAW,KAAK,MAAM,OAAO;AAEtE,WAAO;AAAA,EACT;AAAA,EAEA,MAAM,QACJ,WACA,KACA,IACA,KAKC;AACD,UAAM,WAAW,MAAM,OAAO,gBAAgB,IAAI,WAAW,EAAE,CAAC;AAEhE,UAAM,YAAY,MAAM,KAAK,aAAa;AAAA,MACxC;AAAA,MACA;AAAA,MACA,EAAE,MAAM,UAAU;AAAA,MAClB;AAAA,MACA,CAAC,SAAS;AAAA,IACZ;AAEA,UAAM,gBAA8B;AAAA,MAClC,MAAM;AAAA,MACN,IAAI;AAAA,IACN;AAEA,QAAI,KAAK;AACP,oBAAc,iBAAiB;AAAA,IACjC;AAEA,UAAM,gBAAgB,MAAM,KAAK,aAAa;AAAA,MAC5C;AAAA,MACA;AAAA,MACA;AAAA,IACF;AAEA,UAAM,iBAAiB,IAAI,WAAW,aAAa;AAGnD,UAAM,UAAU;AAChB,UAAM,WAAW,eAAe,SAAS;AACzC,UAAM,MAAM,eAAe,MAAM,QAAQ;AACzC,UAAM,aAAa,eAAe,MAAM,GAAG,QAAQ;AAEnD,WAAO;AAAA,MACL;AAAA,MACA,IAAI;AAAA,MACJ;AAAA,IACF;AAAA,EACF;AAAA,EAEA,MAAM,QACJ,YACA,KACA,IACA,KACA,KACqB;AAErB,UAAM,eAAe,IAAI,WAAW,WAAW,SAAS,IAAI,MAAM;AAClE,iBAAa,IAAI,YAAY,CAAC;AAC9B,iBAAa,IAAI,KAAK,WAAW,MAAM;AAEvC,UAAM,YAAY,MAAM,KAAK,aAAa;AAAA,MACxC;AAAA,MACA;AAAA,MACA,EAAE,MAAM,UAAU;AAAA,MAClB;AAAA,MACA,CAAC,SAAS;AAAA,IACZ;AAEA,UAAM,gBAA8B;AAAA,MAClC,MAAM;AAAA,MACN;AAAA,IACF;AAEA,QAAI,KAAK;AACP,oBAAc,iBAAiB;AAAA,IACjC;AAEA,UAAM,gBAAgB,MAAM,KAAK,aAAa;AAAA,MAC5C;AAAA,MACA;AAAA,MACA;AAAA,IACF;AAEA,WAAO,IAAI,WAAW,aAAa;AAAA,EACrC;AAAA,EAEA,YAAY,QAA4B;AACtC,UAAM,QAAQ,IAAI,WAAW,MAAM;AACnC,WAAO,gBAAgB,KAAK;AAC5B,WAAO;AAAA,EACT;AACF;AAIA,MAAM,iBAAiB,IAAI,MAAM,GAAG;AACpC,SAAS,IAAI,GAAG,IAAI,eAAe,QAAQ,KAAK;AAC9C,iBAAe,CAAC,IAAI,EAAE,SAAS,EAAE,EAAE,SAAS,GAAG,GAAG;AACpD;","names":[]}

package/lib/common/crypto/subtle-crypto-provider.d.ts

@@ -1,11 +1,10 @@
-import { CryptoProvider } from './crypto-provider.js';
-
+import { CryptoProvider } from './crypto-provider';
 /**
  * `CryptoProvider which uses the SubtleCrypto interface of the Web Crypto API.
  *
  * This only supports asynchronous operations.
  */
-declare class SubtleCryptoProvider extends CryptoProvider {
+export declare class SubtleCryptoProvider extends CryptoProvider {
     subtleCrypto: SubtleCrypto;
     constructor(subtleCrypto?: SubtleCrypto);
     computeHMACSignature(_payload: string, _secret: string): string;
@@ -21,5 +20,3 @@ declare class SubtleCryptoProvider extends CryptoProvider {
     decrypt(ciphertext: Uint8Array, key: Uint8Array, iv: Uint8Array, tag: Uint8Array, aad?: Uint8Array): Promise<Uint8Array>;
     randomBytes(length: number): Uint8Array;
 }
-
-export { SubtleCryptoProvider };